@auth0/ai 4.0.2 → 5.0.1

package/dist/cjs/interrupts/index.js

@@ -33,20 +33,20 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeviceInterrupt = exports.DeviceInterrupts = exports.InvalidGrantInterrupt = exports.AuthorizationPollingInterrupt = exports.AuthorizationPendingInterrupt = exports.AuthorizationRequestExpiredInterrupt = exports.UserDoesNotHavePushNotificationsInterrupt = exports.AccessDeniedInterrupt = exports.CIBAInterrupt = exports.FederatedConnectionError = exports.FederatedConnectionInterrupt = exports.Auth0Interrupt = void 0;
+exports.DeviceInterrupt = exports.DeviceInterrupts = exports.InvalidGrantInterrupt = exports.AuthorizationPollingInterrupt = exports.AuthorizationPendingInterrupt = exports.AuthorizationRequestExpiredInterrupt = exports.UserDoesNotHavePushNotificationsInterrupt = exports.AccessDeniedInterrupt = exports.AsyncAuthorizationInterrupt = exports.TokenVaultError = exports.TokenVaultInterrupt = exports.Auth0Interrupt = void 0;
 var Auth0Interrupt_1 = require("./Auth0Interrupt");
 Object.defineProperty(exports, "Auth0Interrupt", { enumerable: true, get: function () { return Auth0Interrupt_1.Auth0Interrupt; } });
-var FederatedConnectionInterrupt_1 = require("./FederatedConnectionInterrupt");
-Object.defineProperty(exports, "FederatedConnectionInterrupt", { enumerable: true, get: function () { return FederatedConnectionInterrupt_1.FederatedConnectionInterrupt; } });
-Object.defineProperty(exports, "FederatedConnectionError", { enumerable: true, get: function () { return FederatedConnectionInterrupt_1.FederatedConnectionError; } });
-var CIBAInterrupts_1 = require("./CIBAInterrupts");
-Object.defineProperty(exports, "CIBAInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.CIBAInterrupt; } });
-Object.defineProperty(exports, "AccessDeniedInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.AccessDeniedInterrupt; } });
-Object.defineProperty(exports, "UserDoesNotHavePushNotificationsInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.UserDoesNotHavePushNotificationsInterrupt; } });
-Object.defineProperty(exports, "AuthorizationRequestExpiredInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.AuthorizationRequestExpiredInterrupt; } });
-Object.defineProperty(exports, "AuthorizationPendingInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.AuthorizationPendingInterrupt; } });
-Object.defineProperty(exports, "AuthorizationPollingInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.AuthorizationPollingInterrupt; } });
-Object.defineProperty(exports, "InvalidGrantInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.InvalidGrantInterrupt; } });
+var TokenVaultInterrupt_1 = require("./TokenVaultInterrupt");
+Object.defineProperty(exports, "TokenVaultInterrupt", { enumerable: true, get: function () { return TokenVaultInterrupt_1.TokenVaultInterrupt; } });
+Object.defineProperty(exports, "TokenVaultError", { enumerable: true, get: function () { return TokenVaultInterrupt_1.TokenVaultError; } });
+var AsyncAuthorizationInterrupt_1 = require("./AsyncAuthorizationInterrupt");
+Object.defineProperty(exports, "AsyncAuthorizationInterrupt", { enumerable: true, get: function () { return AsyncAuthorizationInterrupt_1.AsyncAuthorizationInterrupt; } });
+Object.defineProperty(exports, "AccessDeniedInterrupt", { enumerable: true, get: function () { return AsyncAuthorizationInterrupt_1.AccessDeniedInterrupt; } });
+Object.defineProperty(exports, "UserDoesNotHavePushNotificationsInterrupt", { enumerable: true, get: function () { return AsyncAuthorizationInterrupt_1.UserDoesNotHavePushNotificationsInterrupt; } });
+Object.defineProperty(exports, "AuthorizationRequestExpiredInterrupt", { enumerable: true, get: function () { return AsyncAuthorizationInterrupt_1.AuthorizationRequestExpiredInterrupt; } });
+Object.defineProperty(exports, "AuthorizationPendingInterrupt", { enumerable: true, get: function () { return AsyncAuthorizationInterrupt_1.AuthorizationPendingInterrupt; } });
+Object.defineProperty(exports, "AuthorizationPollingInterrupt", { enumerable: true, get: function () { return AsyncAuthorizationInterrupt_1.AuthorizationPollingInterrupt; } });
+Object.defineProperty(exports, "InvalidGrantInterrupt", { enumerable: true, get: function () { return AsyncAuthorizationInterrupt_1.InvalidGrantInterrupt; } });
 exports.DeviceInterrupts = __importStar(require("./DeviceInterrupts"));
 var DeviceInterrupts_1 = require("./DeviceInterrupts");
 Object.defineProperty(exports, "DeviceInterrupt", { enumerable: true, get: function () { return DeviceInterrupts_1.DeviceInterrupt; } });

package/dist/cjs/interrupts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/interrupts/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AAEvB,+EAGwC;AAFtC,4IAAA,4BAA4B,OAAA;AAC5B,wIAAA,wBAAwB,OAAA;AAG1B,mDAQ0B;AAPxB,+GAAA,aAAa,OAAA;AACb,uHAAA,qBAAqB,OAAA;AACrB,2IAAA,yCAAyC,OAAA;AACzC,sIAAA,oCAAoC,OAAA;AACpC,+HAAA,6BAA6B,OAAA;AAC7B,+HAAA,6BAA6B,OAAA;AAC7B,uHAAA,qBAAqB,OAAA;AAGvB,uEAAuD;AACvD,uDAAqD;AAA5C,mHAAA,eAAe,OAAA","sourcesContent":["export { Auth0Interrupt } from \"./Auth0Interrupt\";\n\nexport {\n  FederatedConnectionInterrupt,\n  FederatedConnectionError,\n} from \"./FederatedConnectionInterrupt\";\n\nexport {\n  CIBAInterrupt,\n  AccessDeniedInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  InvalidGrantInterrupt,\n} from \"./CIBAInterrupts\";\n\nexport * as DeviceInterrupts from \"./DeviceInterrupts\";\nexport { DeviceInterrupt } from \"./DeviceInterrupts\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/interrupts/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AAEvB,6DAG+B;AAF7B,0HAAA,mBAAmB,OAAA;AACnB,sHAAA,eAAe,OAAA;AAGjB,6EAQuC;AAPrC,0IAAA,2BAA2B,OAAA;AAC3B,oIAAA,qBAAqB,OAAA;AACrB,wJAAA,yCAAyC,OAAA;AACzC,mJAAA,oCAAoC,OAAA;AACpC,4IAAA,6BAA6B,OAAA;AAC7B,4IAAA,6BAA6B,OAAA;AAC7B,oIAAA,qBAAqB,OAAA;AAGvB,uEAAuD;AACvD,uDAAqD;AAA5C,mHAAA,eAAe,OAAA","sourcesContent":["export { Auth0Interrupt } from \"./Auth0Interrupt\";\n\nexport {\n  TokenVaultInterrupt,\n  TokenVaultError,\n} from \"./TokenVaultInterrupt\";\n\nexport {\n  AsyncAuthorizationInterrupt,\n  AccessDeniedInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  InvalidGrantInterrupt,\n} from \"./AsyncAuthorizationInterrupt\";\n\nexport * as DeviceInterrupts from \"./DeviceInterrupts\";\nexport { DeviceInterrupt } from \"./DeviceInterrupts\";\n"]}

package/dist/cjs/stores/Store.js

@@ -5,7 +5,7 @@
  * Auth0AI uses this store in different stages:
  *
  * 1. to store the authorization request when an AI agent is interrupted  (CIBA, Device Flow)
- * 2. user credentials associated to threads to avoid re-authentication (CIBA, Device Flow, Federated Connection)
+ * 2. user credentials associated to threads to avoid re-authentication (CIBA, Device Flow, Token Vault)
  *
  */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/stores/Store.js.map

@@ -1 +1 @@
-{"version":3,"file":"Store.js","sourceRoot":"","sources":["../../../src/stores/Store.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG","sourcesContent":["/**\n * A key-value store interface.\n *\n * Auth0AI uses this store in different stages:\n *\n * 1. to store the authorization request when an AI agent is interrupted  (CIBA, Device Flow)\n * 2. user credentials associated to threads to avoid re-authentication (CIBA, Device Flow, Federated Connection)\n *\n */\n\nexport interface Store<T = any> {\n  /**\n   *\n   * Get a value from the store.\n   *\n   * @param namespace - The namespace of the key\n   * @param key - The key\n   */\n  get(namespace: string[], key: string): Promise<T | undefined>;\n\n  /**\n   *\n   * Delete a value from the store.\n   * @param namespace - The namespace of the key\n   * @param key - The key\n   */\n  delete(namespace: string[], key: string): Promise<void>;\n\n  /**\n   *\n   * Put a value in the store.\n   *\n   * @param namespace - The namespace of the key\n   * @param key - The key\n   * @param value - The value to store\n   * @param [options] - The options to store the value\n   * @param [options.expiresIn] - The time in milliseconds to expire the value\n   */\n  put(\n    namespace: string[],\n    key: string,\n    value: T,\n    options?: { expiresIn?: number }\n  ): Promise<void>;\n}\n"]}
+{"version":3,"file":"Store.js","sourceRoot":"","sources":["../../../src/stores/Store.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG","sourcesContent":["/**\n * A key-value store interface.\n *\n * Auth0AI uses this store in different stages:\n *\n * 1. to store the authorization request when an AI agent is interrupted  (CIBA, Device Flow)\n * 2. user credentials associated to threads to avoid re-authentication (CIBA, Device Flow, Token Vault)\n *\n */\n\nexport interface Store<T = any> {\n  /**\n   *\n   * Get a value from the store.\n   *\n   * @param namespace - The namespace of the key\n   * @param key - The key\n   */\n  get(namespace: string[], key: string): Promise<T | undefined>;\n\n  /**\n   *\n   * Delete a value from the store.\n   * @param namespace - The namespace of the key\n   * @param key - The key\n   */\n  delete(namespace: string[], key: string): Promise<void>;\n\n  /**\n   *\n   * Put a value in the store.\n   *\n   * @param namespace - The namespace of the key\n   * @param key - The key\n   * @param value - The value to store\n   * @param [options] - The options to store the value\n   * @param [options.expiresIn] - The time in milliseconds to expire the value\n   */\n  put(\n    namespace: string[],\n    key: string,\n    value: T,\n    options?: { expiresIn?: number }\n  ): Promise<void>;\n}\n"]}

package/dist/esm/authorizers/{ciba/CIBAAuthorizationRequest.d.ts → async-authorization/AsyncAuthorizationRequest.d.ts}

@@ -1,4 +1,4 @@
-export type CIBAAuthorizationRequest = {
+export type AsyncAuthorizationRequest = {
     /**
      * The authorization request ID.
      * Use this ID to check the status of the authorization request.
@@ -17,4 +17,4 @@ export type CIBAAuthorizationRequest = {
      */
     interval: number;
 };
-//# sourceMappingURL=CIBAAuthorizationRequest.d.ts.map
+//# sourceMappingURL=AsyncAuthorizationRequest.d.ts.map

package/dist/esm/authorizers/async-authorization/AsyncAuthorizationRequest.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AsyncAuthorizationRequest.js.map

package/dist/esm/authorizers/async-authorization/AsyncAuthorizationRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AsyncAuthorizationRequest.js","sourceRoot":"","sources":["../../../../src/authorizers/async-authorization/AsyncAuthorizationRequest.ts"],"names":[],"mappings":"","sourcesContent":["export type AsyncAuthorizationRequest = {\n  /**\n   * The authorization request ID.\n   * Use this ID to check the status of the authorization request.\n   */\n  id: string;\n\n  /**\n   * The time the authorization request was made.\n   */\n  requestedAt: number;\n\n  /**\n   * The time in seconds for the authorization request to expire.\n   */\n  expiresIn: number;\n\n  /**\n   * The interval in seconds to use when polling the status.\n   */\n  interval: number;\n};\n"]}

package/dist/esm/authorizers/{ciba/CIBAAuthorizerBase.d.ts → async-authorization/AsyncAuthorizerBase.d.ts}

@@ -2,24 +2,24 @@ import { TokenSet } from "../../credentials";
 import { AuthorizationPendingInterrupt, AuthorizationPollingInterrupt } from "../../interrupts";
 import { ContextGetter } from "../context";
 import { Auth0ClientParams } from "../types";
-import { CIBAAuthorizationRequest } from "./CIBAAuthorizationRequest";
-import { CIBAAuthorizerParams } from "./CIBAAuthorizerParams";
+import { AsyncAuthorizationRequest } from "./AsyncAuthorizationRequest";
+import { AsyncAuthorizerParams } from "./AsyncAuthorizerParams";
 /**
  * Requests authorization by prompting the user via an out-of-band channel from
  * the backend.
  */
-export declare class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {
+export declare class AsyncAuthorizerBase<ToolExecuteArgs extends any[]> {
     private readonly auth0;
     private readonly authResponseStore;
     private readonly credentialsStore;
     private readonly params;
-    constructor(auth0: Partial<Auth0ClientParams>, params: CIBAAuthorizerParams<ToolExecuteArgs>);
+    constructor(auth0: Partial<Auth0ClientParams>, params: AsyncAuthorizerParams<ToolExecuteArgs>);
     private getInstanceID;
     private start;
     private getAuthorizeParams;
     private getCredentialsInternal;
-    protected getCredentials(authRequest: CIBAAuthorizationRequest): Promise<TokenSet | undefined>;
-    protected getCredentialsPolling(authRequest: CIBAAuthorizationRequest): Promise<TokenSet | undefined>;
+    protected getCredentials(authRequest: AsyncAuthorizationRequest): Promise<TokenSet | undefined>;
+    protected getCredentialsPolling(authRequest: AsyncAuthorizationRequest): Promise<TokenSet | undefined>;
     protected deleteAuthRequest(): Promise<void> | undefined;
     /**
      *
@@ -32,4 +32,4 @@ export declare class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {
     protect(getContext: ContextGetter<ToolExecuteArgs>, execute: (...args: ToolExecuteArgs) => any): (...args: ToolExecuteArgs) => any;
     protected handleAuthorizationInterrupts(err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt): Promise<void>;
 }
-//# sourceMappingURL=CIBAAuthorizerBase.d.ts.map
+//# sourceMappingURL=AsyncAuthorizerBase.d.ts.map

package/dist/esm/authorizers/{ciba/CIBAAuthorizerBase.js → async-authorization/AsyncAuthorizerBase.js}

@@ -16,7 +16,7 @@ function ensureOpenIdScope(scopes) {
  * Requests authorization by prompting the user via an out-of-band channel from
  * the backend.
  */
-export class CIBAAuthorizerBase {
+export class AsyncAuthorizerBase {
     constructor(auth0, params) {
         this.auth0 = new AuthenticationClient(Auth0ClientSchema.parse(auth0));
         this.params = {
@@ -231,4 +231,4 @@ export class CIBAAuthorizerBase {
         throw err;
     }
 }
-//# sourceMappingURL=CIBAAuthorizerBase.js.map
+//# sourceMappingURL=AsyncAuthorizerBase.js.map

package/dist/esm/authorizers/async-authorization/AsyncAuthorizerBase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AsyncAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/async-authorization/AsyncAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAAY,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,6BAA6B,EAC7B,oCAAoC,EACpC,qBAAqB,EACrB,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAGhE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAE3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAU9B,YACE,KAAiC,EACjC,MAA8C;QAE9C,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,WAAW;YAC/B,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,iBAAiB,GAAG,IAAI,QAAQ,CACnC,MAAM,CAAC,KAAK,EACZ;YACE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CACvB,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACrE,CACF,CAAC;QAEF,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,eAAoB;QACxC,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,eAAe;SACxB,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,eAAoB;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,yCAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,WAA4B;;QAC3D,MAAM,UAAU,GAAwB;YACtC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,gBAAgB,EAAE,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,eAAe,mCAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;YACjE,eAAe,EACb,MAAA,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;YACzE,MAAM,EAAE,MAAA,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;SACxE,CAAC;QAEF,MAAM,oBAAoB,GAAG,MAAM,gBAAgB,CACjD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAChC,WAAW,CACZ,CAAC;QAEF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC1E,CAAC;QAED,qDAAqD;QACrD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CACtE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAsC;QAEtC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,oCAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAExD,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,EACX,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CACrC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,yCAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAsC;QACnE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAsC;QAEtC,IAAI,WAAW,GAAyB,SAAS,CAAC;QAElD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,6BAA6B;oBAC5C,GAAG,YAAY,6BAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;;QACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QACjC,OAAO,MAAA,IAAI,CAAC,iBAAiB,0CAAE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,YAAmD,CAAC;YACxD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG;gBACrB,UAAU;gBACV,eAAe;gBACf,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;aACvC,CAAC;YACF,MAAM,aAAa,GAAG;gBACpB,UAAU;gBACV,aAAa;gBACb,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC;aAC1D,CAAC;YAEF,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO;gBACP,cAAc;aACf,CAAC;YAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;;gBAClD,IAAI,WAAiC,CAAC;gBAEtC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CAC5C,aAAa,EACb,YAAY,CACb,CAAA,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,IAAI,aAAa,EAAE,CAAC;4BAClB,YAAY,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC9C,cAAc,EACd,cAAc,CACf,CAAA,CAAC;4BACF,IAAI,CAAC,YAAY,EAAE,CAAC;gCAClB,iBAAiB;gCACjB,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gCACjD,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC/B,cAAc,EACd,cAAc,EACd,YAAY,CACb,CAAA,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;wBACxD,CAAC;6BAAM,CAAC;4BACN,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;4BACjD,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;4BAC3C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;gCAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACtC,YAAY,EACZ,kBAAkB,CACnB,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,kBAAkB,CAAC;wBACzC,CAAC;wBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;4BACvC,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CACxB,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,6BAA6B;wBAC5C,GAAG,YAAY,6BAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAkE;QAElE,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;CACF","sourcesContent":["import { AuthenticationClient } from \"auth0\";\nimport crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport { TokenSet, tokenSetFromTokenResponse } from \"../../credentials\";\nimport {\n  AccessDeniedInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  InvalidGrantInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { AsyncAuthorizationRequest } from \"./AsyncAuthorizationRequest\";\nimport { AsyncAuthorizerParams } from \"./AsyncAuthorizerParams\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n  return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class AsyncAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: AuthenticationClient;\n  private readonly authResponseStore: SubStore | undefined;\n  private readonly credentialsStore: SubStore<TokenSet> | undefined;\n\n  private readonly params: RequireFields<\n    AsyncAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: AsyncAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = new AuthenticationClient(Auth0ClientSchema.parse(auth0));\n    this.params = {\n      credentialsContext: \"tool-call\",\n      ...params,\n    };\n\n    this.authResponseStore = new SubStore<AsyncAuthorizationRequest>(\n      params.store,\n      {\n        getTTL: (authResponse) =>\n          authResponse.expiresIn ? authResponse.expiresIn * 1000 : undefined,\n      }\n    );\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n  }\n\n  private getInstanceID(authorizeParams: any): string {\n    const props = {\n      auth0: this.auth0,\n      params: authorizeParams,\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  private async start(authorizeParams: any): Promise<AsyncAuthorizationRequest> {\n    const requestedAt = Date.now() / 1000;\n\n    try {\n      const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n      return {\n        id: response.auth_req_id,\n        requestedAt: requestedAt,\n        expiresIn: response.expires_in,\n        interval: response.interval,\n      };\n    } catch (err: any) {\n      if (err.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          err.error_description\n        );\n      }\n      throw err;\n    }\n  }\n\n  private async getAuthorizeParams(toolContext: ToolExecuteArgs) {\n    const authParams: Record<string, any> = {\n      scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n      audience: this.params.audience || \"\",\n      requested_expiry: (this.params.requestedExpiry ?? 300).toString(),\n      binding_message:\n        (await resolveParameter(this.params.bindingMessage, toolContext)) ?? \"\",\n      userId: (await resolveParameter(this.params.userID, toolContext)) ?? \"\",\n    };\n\n    const authorizationDetails = await resolveParameter(\n      this.params.authorizationDetails,\n      toolContext\n    );\n\n    // If authorizationDetails is an array, we need to convert it to a string\n    // because the auth0 library expects a valid JSON string.\n    if (authorizationDetails !== undefined) {\n      authParams.authorization_details = JSON.stringify(authorizationDetails);\n    }\n\n    // Remove undefined values from the authParams object\n    return Object.fromEntries(\n      Object.entries(authParams).filter(([, value]) => value !== undefined)\n    );\n  }\n\n  private async getCredentialsInternal(\n    authRequest: AsyncAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    try {\n      const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n      if (elapsedSeconds >= authRequest.expiresIn) {\n        throw new AuthorizationRequestExpiredInterrupt(\n          \"The authorization request has expired.\",\n          authRequest\n        );\n      }\n\n      const response = await this.auth0.backchannel.backchannelGrant({\n        auth_req_id: authRequest.id,\n      });\n\n      const credentials = tokenSetFromTokenResponse(response);\n\n      return credentials;\n    } catch (e: any) {\n      if (e.error === \"authorization_pending\") {\n        throw new AuthorizationPendingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error === \"slow_down\") {\n        throw new AuthorizationPollingInterrupt(\n          e.error_description,\n          authRequest,\n          Number(e.headers.get('retry-after'))\n        );\n      }\n\n      if (e.error == \"invalid_grant\") {\n        throw new InvalidGrantInterrupt(e.error_description, authRequest);\n      }\n\n      if (e.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          e.error_description\n        );\n      }\n\n      if (e.error == \"access_denied\") {\n        throw new AccessDeniedInterrupt(e.error_description, authRequest);\n      }\n\n      throw e;\n    }\n  }\n\n  protected async getCredentials(authRequest: AsyncAuthorizationRequest) {\n    return this.getCredentialsInternal(authRequest);\n  }\n\n  protected async getCredentialsPolling(\n    authRequest: AsyncAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    let credentials: TokenSet | undefined = undefined;\n\n    do {\n      try {\n        credentials = await this.getCredentialsInternal(authRequest);\n      } catch (err) {\n        if (\n          err instanceof AuthorizationPendingInterrupt ||\n          err instanceof AuthorizationPollingInterrupt\n        ) {\n          await sleep(err.nextRetryInterval() * 1000);\n        } else {\n          throw err;\n        }\n      }\n    } while (!credentials);\n\n    return credentials;\n  }\n\n  protected deleteAuthRequest() {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\"This method should be called from within a tool.\");\n    }\n    const { authResponseNS } = store;\n    return this.authResponseStore?.delete(authResponseNS, \"authResponse\");\n  }\n\n  /**\n   *\n   * Wraps the execute method of a AI tool to handle CIBA authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      let authResponse: AsyncAuthorizationRequest | undefined;\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require CIBA authorization.\"\n        );\n      }\n\n      const context = getContext(...args);\n      const authorizeParams = await this.getAuthorizeParams(args);\n      const instanceID = this.getInstanceID(authorizeParams);\n      const authResponseNS = [\n        instanceID,\n        \"AuthResponses\",\n        ...nsFromContext(\"tool-call\", context),\n      ];\n      const credentialsNS = [\n        instanceID,\n        \"Credentials\",\n        ...nsFromContext(this.params.credentialsContext, context),\n      ];\n\n      const storeValue: AsyncStorageValue<any> = {\n        args,\n        context,\n        authResponseNS,\n      };\n\n      return asyncLocalStorage.run(storeValue, async () => {\n        let credentials: TokenSet | undefined;\n\n        const interruptMode =\n          typeof this.params.onAuthorizationRequest === \"undefined\" ||\n          this.params.onAuthorizationRequest === \"interrupt\";\n\n        try {\n          credentials = await this.credentialsStore?.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            if (interruptMode) {\n              authResponse = await this.authResponseStore?.get(\n                authResponseNS,\n                \"authResponse\"\n              );\n              if (!authResponse) {\n                //Initial request\n                authResponse = await this.start(authorizeParams);\n                await this.authResponseStore?.put(\n                  authResponseNS,\n                  \"authResponse\",\n                  authResponse\n                );\n              }\n              credentials = await this.getCredentials(authResponse);\n            } else {\n              authResponse = await this.start(authorizeParams);\n              const credentialsPromise =\n                this.getCredentialsPolling(authResponse);\n              if (typeof this.params.onAuthorizationRequest === \"function\") {\n                await this.params.onAuthorizationRequest(\n                  authResponse,\n                  credentialsPromise\n                );\n              }\n              credentials = await credentialsPromise;\n            }\n            await this.deleteAuthRequest();\n            if (typeof credentials !== \"undefined\") {\n              this.credentialsStore?.put(\n                credentialsNS,\n                \"credential\",\n                credentials\n              );\n            }\n          }\n        } catch (err) {\n          const shouldInterrupt =\n            err instanceof AuthorizationPendingInterrupt ||\n            err instanceof AuthorizationPollingInterrupt;\n          if (shouldInterrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          } else {\n            await this.deleteAuthRequest();\n            if (typeof this.params.onUnauthorized === \"function\") {\n              return this.params.onUnauthorized(err as Error, ...args);\n            } else {\n              return err;\n            }\n          }\n        }\n        storeValue.credentials = credentials;\n        return execute(...args);\n      });\n    };\n  }\n\n  protected async handleAuthorizationInterrupts(\n    err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n  ) {\n    if (this.params.onAuthorizationInterrupt) {\n      const store = asyncLocalStorage.getStore();\n      if (!store) {\n        throw new Error(\"This method should be called from within a tool.\");\n      }\n      const { context } = store;\n      await this.params.onAuthorizationInterrupt(err, context);\n    }\n    throw err;\n  }\n}\n"]}

package/dist/esm/authorizers/{ciba/CIBAAuthorizerParams.d.ts → async-authorization/AsyncAuthorizerParams.d.ts}

@@ -1,11 +1,11 @@
 import { AuthorizationDetails, TokenSet } from "../../credentials";
-import { AuthorizationPendingInterrupt, AuthorizationPollingInterrupt, CIBAInterrupt } from "../../interrupts";
+import { AsyncAuthorizationInterrupt, AuthorizationPendingInterrupt, AuthorizationPollingInterrupt } from "../../interrupts";
 import { AuthorizerToolParameter } from "../../parameters";
 import { Store } from "../../stores";
 import { AuthContext, ToolCallContext } from "../context";
 import { OnAuthorizationRequest } from "../types";
-import { CIBAAuthorizationRequest } from "./CIBAAuthorizationRequest";
-export type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {
+import { AsyncAuthorizationRequest } from "./AsyncAuthorizationRequest";
+export type AsyncAuthorizerParams<ToolExecuteArgs extends any[]> = {
     /**
      * The scope to request authorization for.
      */
@@ -42,7 +42,7 @@ export type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {
      * Defaults to `interrupt`.
      * Note: The block mode is only useful for development purposes and should not be used in production.
      */
-    onAuthorizationRequest?: OnAuthorizationRequest | ((authReq: CIBAAuthorizationRequest, poll: Promise<TokenSet | undefined>) => Promise<void>);
+    onAuthorizationRequest?: OnAuthorizationRequest | ((authReq: AsyncAuthorizationRequest, poll: Promise<TokenSet | undefined>) => Promise<void>);
     /**
      * AuthContext defines the scope of credential sharing:
      * - "tool-call": Credentials are valid only for a single invocation of the tool.
@@ -62,7 +62,7 @@ export type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {
      * @param args - The tool execution arguments.
      * @returns The response to return when the invocation is not authorized.
      */
-    onUnauthorized?: (err: Error | CIBAInterrupt, ...args: ToolExecuteArgs) => any;
+    onUnauthorized?: (err: Error | AsyncAuthorizationInterrupt, ...args: ToolExecuteArgs) => any;
     /**
      * Callback called before the authorization interrupt is thrown.
      * This callback is useful to setup CIBA pollers.
@@ -77,4 +77,4 @@ export type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {
      */
     store: Store;
 };
-//# sourceMappingURL=CIBAAuthorizerParams.d.ts.map
+//# sourceMappingURL=AsyncAuthorizerParams.d.ts.map

package/dist/esm/authorizers/async-authorization/AsyncAuthorizerParams.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AsyncAuthorizerParams.js.map

package/dist/esm/authorizers/async-authorization/AsyncAuthorizerParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AsyncAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/async-authorization/AsyncAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { AuthorizationDetails, TokenSet } from \"../../credentials\";\nimport {\n  AsyncAuthorizationInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n} from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext, ToolCallContext } from \"../context\";\nimport { OnAuthorizationRequest } from \"../types\";\nimport { AsyncAuthorizationRequest } from \"./AsyncAuthorizationRequest\";\n\nexport type AsyncAuthorizerParams<ToolExecuteArgs extends any[]> = {\n  /**\n   * The scope to request authorization for.\n   */\n  scopes: string[];\n\n  /**\n   * The user ID to request authorization for.\n   */\n  userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The binding message to send to the user.\n   */\n  bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The authorization parameters for RAR request.\n   */\n  authorizationDetails?: AuthorizerToolParameter<\n    ToolExecuteArgs,\n    AuthorizationDetails[]\n  >;\n\n  /**\n   * The audience to request authorization for.\n   */\n  audience?: string;\n\n  /**\n   * The time in seconds for the authorization request to expire.\n   *\n   * Defaults to 300 (5 minutes).\n   */\n  requestedExpiry?: number;\n\n  /**\n   * The behavior when the authorization request is made.\n   *\n   * - `block`: The tool execution is blocked until the user completes the authorization.\n   * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n   * - a callback: Same as \"block\" but give access to the auth request and executing logic.\n   *\n   * Defaults to `interrupt`.\n   * Note: The block mode is only useful for development purposes and should not be used in production.\n   */\n  onAuthorizationRequest?:\n    | OnAuthorizationRequest\n    | ((\n        authReq: AsyncAuthorizationRequest,\n        poll: Promise<TokenSet | undefined>\n      ) => Promise<void>);\n\n  /**\n   * AuthContext defines the scope of credential sharing:\n   * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n   * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n   * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n   * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n   *\n   * @default \"tool-call\"\n   */\n  credentialsContext?: AuthContext;\n\n  /**\n   *\n   * Optional callback to generate a tool result when the invocation is not authorized.\n   *\n   * By default it will return the instance of the Error.\n   *\n   * @param args - The tool execution arguments.\n   * @returns The response to return when the invocation is not authorized.\n   */\n  onUnauthorized?: (\n    err: Error | AsyncAuthorizationInterrupt,\n    ...args: ToolExecuteArgs\n  ) => any;\n\n  /**\n   * Callback called before the authorization interrupt is thrown.\n   * This callback is useful to setup CIBA pollers.\n   *\n   * @param interrupt - The interrupt that is about to be thrown.\n   * @param args - The tool execution arguments.\n   */\n  onAuthorizationInterrupt?: (\n    interrupt: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt,\n    context: ToolCallContext,\n  ) => void | Promise<void>;\n\n  /**\n   * An store used to temporarly store the authorization response data\n   * while the user is completing the authorization in another device.\n   */\n  store: Store;\n};\n"]}

package/dist/esm/authorizers/{ciba → async-authorization}/asyncLocalStorage.d.ts

@@ -16,5 +16,5 @@ export type AsyncStorageValue<TContext> = {
     authResponseNS: string[];
 };
 export declare const asyncLocalStorage: AsyncLocalStorage<AsyncStorageValue<any>>;
-export declare const getCIBACredentials: () => TokenSet | undefined;
+export declare const getAsyncAuthorizationCredentials: () => TokenSet | undefined;
 //# sourceMappingURL=asyncLocalStorage.d.ts.map

package/dist/esm/authorizers/{ciba → async-authorization}/asyncLocalStorage.js

@@ -1,9 +1,9 @@
 import { AsyncLocalStorage } from "async_hooks";
 export const asyncLocalStorage = new AsyncLocalStorage();
-export const getCIBACredentials = () => {
+export const getAsyncAuthorizationCredentials = () => {
     const t = asyncLocalStorage.getStore();
     if (typeof t === "undefined") {
-        throw new Error("The tool must be wrapped with the withAsyncUserConfirmation function.");
+        throw new Error("The tool must be wrapped with the withAsyncAuthorization function.");
     }
     return t.credentials;
 };

package/dist/esm/authorizers/async-authorization/asyncLocalStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asyncLocalStorage.js","sourceRoot":"","sources":["../../../../src/authorizers/async-authorization/asyncLocalStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAuBhD,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAEnD,CAAC;AAEJ,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,EAAE;IACnD,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,CAAC;AACvB,CAAC,CAAC","sourcesContent":["import { AsyncLocalStorage } from \"async_hooks\";\n\nimport { TokenSet } from \"../../credentials\";\n\nexport type AsyncStorageValue<TContext> = {\n  credentials?: TokenSet;\n\n  /**\n   * The tool execution context.\n   */\n  context: TContext;\n\n  /**\n   * The tool execution arguments.\n   */\n  args: any[];\n\n  /**\n   * The namespace in the Store for the CIBA authorization response.\n   */\n  authResponseNS: string[];\n};\n\nexport const asyncLocalStorage = new AsyncLocalStorage<\n  AsyncStorageValue<any>\n>();\n\nexport const getAsyncAuthorizationCredentials = () => {\n  const t = asyncLocalStorage.getStore();\n  if (typeof t === \"undefined\") {\n    throw new Error(\n      \"The tool must be wrapped with the withAsyncAuthorization function.\"\n    );\n  }\n  return t.credentials;\n};\n"]}

package/dist/esm/authorizers/async-authorization/index.d.ts

@@ -0,0 +1,4 @@
+export { asyncLocalStorage, getAsyncAuthorizationCredentials } from "./asyncLocalStorage";
+export type { AsyncAuthorizationRequest } from "./AsyncAuthorizationRequest";
+export { AsyncAuthorizerBase } from "./AsyncAuthorizerBase";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/authorizers/async-authorization/index.js

@@ -0,0 +1,3 @@
+export { asyncLocalStorage, getAsyncAuthorizationCredentials } from "./asyncLocalStorage";
+export { AsyncAuthorizerBase } from "./AsyncAuthorizerBase";
+//# sourceMappingURL=index.js.map

package/dist/esm/authorizers/async-authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/async-authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAI1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC","sourcesContent":["export { asyncLocalStorage, getAsyncAuthorizationCredentials } from \"./asyncLocalStorage\";\n\nexport type { AsyncAuthorizationRequest } from \"./AsyncAuthorizationRequest\";\n\nexport { AsyncAuthorizerBase } from \"./AsyncAuthorizerBase\";\n"]}

package/dist/esm/authorizers/device-authorizer/asyncLocalStorage.js

@@ -3,7 +3,7 @@ export const asyncLocalStorage = new AsyncLocalStorage();
 export const getDeviceAuthorizerCredentials = () => {
     const t = asyncLocalStorage.getStore();
     if (typeof t === "undefined") {
-        throw new Error("The tool must be wrapped with the withAsyncUserConfirmation function.");
+        throw new Error("The tool must be wrapped with the withAsyncAuthorization function.");
     }
     return t.credentials;
 };

package/dist/esm/authorizers/device-authorizer/asyncLocalStorage.js.map

@@ -1 +1 @@
-{"version":3,"file":"asyncLocalStorage.js","sourceRoot":"","sources":["../../../../src/authorizers/device-authorizer/asyncLocalStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAkBhD,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAEnD,CAAC;AAEJ,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE;IACjD,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,CAAC;AACvB,CAAC,CAAC","sourcesContent":["import { AsyncLocalStorage } from \"async_hooks\";\n\nimport { TokenSet } from \"../../credentials\";\n\nexport type AsyncStorageValue<TContext> = {\n  credentials?: TokenSet;\n\n  /**\n   * The tool execution context.\n   */\n  context: TContext;\n\n  /**\n   * The tool execution arguments.\n   */\n  args: any[];\n};\n\nexport const asyncLocalStorage = new AsyncLocalStorage<\n  AsyncStorageValue<any>\n>();\n\nexport const getDeviceAuthorizerCredentials = () => {\n  const t = asyncLocalStorage.getStore();\n  if (typeof t === \"undefined\") {\n    throw new Error(\n      \"The tool must be wrapped with the withAsyncUserConfirmation function.\"\n    );\n  }\n  return t.credentials;\n};\n"]}
+{"version":3,"file":"asyncLocalStorage.js","sourceRoot":"","sources":["../../../../src/authorizers/device-authorizer/asyncLocalStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAkBhD,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAEnD,CAAC;AAEJ,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE;IACjD,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,CAAC;AACvB,CAAC,CAAC","sourcesContent":["import { AsyncLocalStorage } from \"async_hooks\";\n\nimport { TokenSet } from \"../../credentials\";\n\nexport type AsyncStorageValue<TContext> = {\n  credentials?: TokenSet;\n\n  /**\n   * The tool execution context.\n   */\n  context: TContext;\n\n  /**\n   * The tool execution arguments.\n   */\n  args: any[];\n};\n\nexport const asyncLocalStorage = new AsyncLocalStorage<\n  AsyncStorageValue<any>\n>();\n\nexport const getDeviceAuthorizerCredentials = () => {\n  const t = asyncLocalStorage.getStore();\n  if (typeof t === \"undefined\") {\n    throw new Error(\n      \"The tool must be wrapped with the withAsyncAuthorization function.\"\n    );\n  }\n  return t.credentials;\n};\n"]}

package/dist/esm/authorizers/{federated-connections/FederatedConnectionAuthorizerBase.d.ts → token-vault/TokenVaultAuthorizerBase.d.ts}

@@ -2,15 +2,15 @@ import { TokenResponse, TokenSet } from "../../credentials";
 import { Auth0Interrupt } from "../../interrupts";
 import { ContextGetter } from "../context";
 import { Auth0ClientParams } from "../types";
-import { FederatedConnectionAuthorizerParams } from "./FederatedConnectionAuthorizerParams";
+import { TokenVaultAuthorizerParams } from "./TokenVaultAuthorizerParams";
 /**
- * Requests authorization to a third party service via Federated Connection.
+ * Requests authorization to a third party service via Token Vault.
  */
-export declare class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {
+export declare class TokenVaultAuthorizerBase<ToolExecuteArgs extends any[]> {
     private readonly auth0;
     private readonly params;
     private readonly credentialsStore;
-    constructor(auth0: Partial<Auth0ClientParams>, params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>);
+    constructor(auth0: Partial<Auth0ClientParams>, params: TokenVaultAuthorizerParams<ToolExecuteArgs>);
     private getInstanceID;
     protected handleAuthorizationInterrupts(err: Auth0Interrupt): void;
     protected validateToken(tokenResponse?: TokenResponse): void;
@@ -20,7 +20,7 @@ export declare class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends a
     protected getAccessTokenWithToolContext(...toolContext: ToolExecuteArgs): Promise<string | TokenResponse | undefined>;
     /**
      *
-     * Wraps the execute method of an AI tool to handle Federated Connections authorization.
+     * Wraps the execute method of an AI tool to handle Token Vaults authorization.
      *
      * @param getContext - A function that returns the context of the tool execution.
      * @param execute - The tool execute method.
@@ -28,4 +28,4 @@ export declare class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends a
      */
     protect(getContext: ContextGetter<ToolExecuteArgs>, execute: (...args: ToolExecuteArgs) => any): (...args: ToolExecuteArgs) => any;
 }
-//# sourceMappingURL=FederatedConnectionAuthorizerBase.d.ts.map
+//# sourceMappingURL=TokenVaultAuthorizerBase.d.ts.map

package/dist/esm/authorizers/{federated-connections/FederatedConnectionAuthorizerBase.js → token-vault/TokenVaultAuthorizerBase.js}

@@ -1,18 +1,18 @@
 import crypto from "crypto";
 import stableHash from "stable-hash";
-import { tokenSetFromTokenResponse, } from "../../credentials";
-import { Auth0Interrupt, FederatedConnectionError, FederatedConnectionInterrupt, } from "../../interrupts";
+import { tokenSetFromTokenResponse } from "../../credentials";
+import { Auth0Interrupt, TokenVaultError, TokenVaultInterrupt } from "../../interrupts";
 import { resolveParameter } from "../../parameters";
 import { SubStore } from "../../stores";
 import { omit } from "../../util";
 import { nsFromContext } from "../context";
 import { Auth0ClientSchema } from "../types";
 import { asyncLocalStorage } from "./asyncLocalStorage";
-import { SUBJECT_TOKEN_TYPES, } from "./FederatedConnectionAuthorizerParams";
+import { SUBJECT_TOKEN_TYPES } from "./TokenVaultAuthorizerParams";
 /**
- * Requests authorization to a third party service via Federated Connection.
+ * Requests authorization to a third party service via Token Vault.
  */
-export class FederatedConnectionAuthorizerBase {
+export class TokenVaultAuthorizerBase {
     constructor(auth0, params) {
         this.auth0 = Auth0ClientSchema.parse(auth0);
         this.params = {
@@ -67,7 +67,7 @@ export class FederatedConnectionAuthorizerBase {
         }
         const { scopes, connection } = store;
         if (!tokenResponse) {
-            throw new FederatedConnectionInterrupt(`Authorization required to access the Federated Connection: ${this.params.connection}`, connection, scopes, scopes);
+            throw new TokenVaultInterrupt(`Authorization required to access the Token Vault: ${this.params.connection}`, connection, scopes, scopes);
         }
         const currentScopes = ((_a = tokenResponse.scope) !== null && _a !== void 0 ? _a : "")
             .replace(/,/g, " ")
@@ -75,7 +75,7 @@ export class FederatedConnectionAuthorizerBase {
         const missingScopes = scopes.filter((s) => !currentScopes.includes(s));
         store.currentScopes = currentScopes;
         if (missingScopes.length > 0) {
-            throw new FederatedConnectionInterrupt(`Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(", ")}`, connection, scopes, [...currentScopes, ...scopes]);
+            throw new TokenVaultInterrupt(`Authorization required to access the Token Vault: ${this.params.connection}. Missing scopes: ${missingScopes.join(", ")}`, connection, scopes, [...currentScopes, ...scopes]);
         }
     }
     async getAccessTokenImpl(...toolContext) {
@@ -156,7 +156,7 @@ export class FederatedConnectionAuthorizerBase {
     }
     /**
      *
-     * Wraps the execute method of an AI tool to handle Federated Connections authorization.
+     * Wraps the execute method of an AI tool to handle Token Vaults authorization.
      *
      * @param getContext - A function that returns the context of the tool execution.
      * @param execute - The tool execute method.
@@ -171,7 +171,7 @@ export class FederatedConnectionAuthorizerBase {
                 connection: this.params.connection,
             };
             if (asyncLocalStorage.getStore()) {
-                throw new Error("Cannot nest tool calls that require federated connection authorization.");
+                throw new Error("Cannot nest tool calls that require Token Vault authorization.");
             }
             return asyncLocalStorage.run(asyncStore, async () => {
                 const credentialsNS = nsFromContext(this.params.credentialsContext, context);
@@ -185,9 +185,9 @@ export class FederatedConnectionAuthorizerBase {
                     return await execute(...args);
                 }
                 catch (err) {
-                    if (err instanceof FederatedConnectionError) {
+                    if (err instanceof TokenVaultError) {
                         this.credentialsStore.delete(credentialsNS, "credential");
-                        const interrupt = new FederatedConnectionInterrupt(err.message, asyncStore.connection, asyncStore.scopes, asyncStore.scopes);
+                        const interrupt = new TokenVaultInterrupt(err.message, asyncStore.connection, asyncStore.scopes, asyncStore.scopes);
                         return this.handleAuthorizationInterrupts(interrupt);
                     }
                     if (err instanceof Auth0Interrupt) {
@@ -200,4 +200,4 @@ export class FederatedConnectionAuthorizerBase {
         };
     }
 }
-//# sourceMappingURL=FederatedConnectionAuthorizerBase.js.map
+//# sourceMappingURL=TokenVaultAuthorizerBase.js.map

package/dist/esm/authorizers/token-vault/TokenVaultAuthorizerBase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenVaultAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/token-vault/TokenVaultAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAA2B,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,IAAI,EAAiB,MAAM,YAAY,CAAC;AACjD,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAA8B,MAAM,8BAA8B,CAAC;AAE/F;;GAEG;AAEH,MAAM,OAAO,wBAAwB;IAQnC,YACE,KAAiC,EACjC,MAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;QACjE,MAAM,mBAAmB,GAAG,OAAO,MAAM,CAAC,gBAAgB,KAAK,WAAW,CAAC;QAE3E,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,yGAAyG;QACzG,IACE,cAAc;YACd,mBAAmB;YACnB,MAAM,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,yBAAyB,EACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACxB,OAAO;gBACP,cAAc;gBACd,aAAa;gBACb,WAAW;aACZ,CAAC;SACH,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAC7E,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,mBAAmB,CAC3B,qDAAqD,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1H,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,0EAA0E;QAC1E,IAAI,YAAgC,CAAC;QACrC,IAAI,gBAAwB,CAAC;QAE7B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;YAC1D,gBAAgB,GAAG,gDAAgD,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,6BAA6B,CACtD,GAAG,WAAW,CACf,CAAW,CAAC;YACb,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,gBAAgB,GAAG,+CAA+C,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gBAAgB;YACpC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,iGAAiG;QACjG,IACE,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC9C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAC7C,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,mBAAmB,CAAC,yBAAyB,CAAC,EAClD,CAAC;YACD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,aAAa,GAAG,CAAC,MAAM,gBAAgB,CACrC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAkB,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,yBAAyB,CAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAG,WAA4B;QAE/B,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;YAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;wBACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,mBAAmB,CACvC,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport { TokenResponse, TokenSet, tokenSetFromTokenResponse } from \"../../credentials\";\nimport { Auth0Interrupt, TokenVaultError, TokenVaultInterrupt } from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { SUBJECT_TOKEN_TYPES, TokenVaultAuthorizerParams } from \"./TokenVaultAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Token Vault.\n */\n\nexport class TokenVaultAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    TokenVaultAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: TokenVaultAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    // Validate that exactly one token source is provided\n    const hasRefreshToken = typeof params.refreshToken !== \"undefined\";\n    const hasAccessToken = typeof params.accessToken !== \"undefined\";\n    const hasSubjectTokenType = typeof params.subjectTokenType !== \"undefined\";\n\n    if (!hasRefreshToken && !hasAccessToken) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (hasRefreshToken && hasAccessToken) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n\n    // Validate resource server client credentials when using access tokens for token exchange w/ Token Vault\n    if (\n      hasAccessToken &&\n      hasSubjectTokenType &&\n      params.subjectTokenType === SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN\n    ) {\n      if (!this.auth0.clientId || !this.auth0.clientSecret) {\n        throw new Error(\n          \"clientId and clientSecret must currently be provided when using accessToken for token exchange with Token Vault.\"\n        );\n      }\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\n        \"store\",\n        \"refreshToken\",\n        \"accessToken\",\n        \"loginHint\",\n      ]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new TokenVaultInterrupt(\n        `Authorization required to access the Token Vault: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\")\n      .replace(/,/g, \" \")\n      .split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new TokenVaultInterrupt(\n        `Authorization required to access the Token Vault: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    // Determine which token type to use and get the appropriate subject token\n    let subjectToken: string | undefined;\n    let subjectTokenType: string;\n\n    if (typeof this.params.refreshToken === \"function\") {\n      subjectToken = await this.getRefreshToken(...toolContext);\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:refresh_token\";\n    } else if (typeof this.params.accessToken === \"function\") {\n      subjectToken = (await this.getAccessTokenWithToolContext(\n        ...toolContext\n      )) as string;\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n    } else if (typeof this.params.accessToken === \"string\") {\n      subjectToken = this.params.accessToken;\n      subjectTokenType = \"urn:ietf:params:oauth:token-type:access_token\";\n    } else {\n      // This should never happen due to constructor validation, but TypeScript needs this\n      throw new Error(\"Either refreshToken or accessToken must be configured\");\n    }\n\n    if (!subjectToken) {\n      return;\n    }\n\n    // Get optional login hint if provided\n    const loginHint =\n      typeof this.params.loginHint === \"function\"\n        ? await resolveParameter(this.params.loginHint, toolContext)\n        : undefined;\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: subjectTokenType,\n      subject_token: subjectToken,\n      login_hint: loginHint,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    // Use token exchange for both refresh tokens and access tokens when subjectTokenType is provided\n    if (\n      typeof this.params.refreshToken === \"function\" ||\n      (typeof this.params.accessToken !== \"undefined\" &&\n        this.params.subjectTokenType ===\n          SUBJECT_TOKEN_TYPES.SUBJECT_TYPE_ACCESS_TOKEN)\n    ) {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      // fallback to existing behavior, where third party accessToken can be provided directly\n      tokenResponse = (await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      )) as TokenResponse;\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  protected async getAccessTokenWithToolContext(\n    ...toolContext: ToolExecuteArgs\n  ) {\n    return await resolveParameter(this.params.accessToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Token Vaults authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require Token Vault authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof TokenVaultError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new TokenVaultInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}

package/dist/esm/authorizers/{federated-connections/FederatedConnectionAuthorizerParams.d.ts → token-vault/TokenVaultAuthorizerParams.d.ts}

@@ -16,14 +16,14 @@ export declare enum SUBJECT_TOKEN_TYPES {
      */
     SUBJECT_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token"
 }
-export type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> = {
+export type TokenVaultAuthorizerParams<ToolExecuteArgs extends any[]> = {
     /**
-     * The Auth0 refresh token to exchange for an Federated Connection access token.
+     * The Auth0 refresh token to exchange for an Token Vault access token.
      */
     refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;
     /**
-     * The Federated connection access token if available in the tool context.
-     * This can also be provided as a string exchange when exchanging an access token for a Federated Connection access token.
+     * The Token Vault access token if available in the tool context.
+     * This can also be provided as a string exchange when exchanging an access token for a Token Vault access token.
      */
     accessToken?: AuthorizerToolParameter<ToolExecuteArgs, TokenResponse | string | undefined> | string | undefined;
     /**
@@ -31,15 +31,15 @@ export type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =
      */
     subjectTokenType?: SUBJECT_TOKEN_TYPES | undefined;
     /**
-     * Optional login hint to provide when exchanging an access or refresh token for a Federated Connection access token.
+     * Optional login hint to provide when exchanging an access or refresh token for a Token Vault access token.
      */
     loginHint?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;
     /**
-     * The scopes required in the access token of the federated connection provider.
+     * The scopes required in the access token of the token vault provider.
      */
     scopes: string[];
     /**
-     * The connection name of the federated connection provider.
+     * The connection name of the token vault provider.
      */
     connection: string;
     /**
@@ -58,4 +58,4 @@ export type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =
      */
     store: Store;
 };
-//# sourceMappingURL=FederatedConnectionAuthorizerParams.d.ts.map
+//# sourceMappingURL=TokenVaultAuthorizerParams.d.ts.map

package/dist/esm/authorizers/{federated-connections/FederatedConnectionAuthorizerParams.js → token-vault/TokenVaultAuthorizerParams.js}

@@ -13,4 +13,4 @@ export var SUBJECT_TOKEN_TYPES;
      */
     SUBJECT_TOKEN_TYPES["SUBJECT_TYPE_ACCESS_TOKEN"] = "urn:ietf:params:oauth:token-type:access_token";
 })(SUBJECT_TOKEN_TYPES || (SUBJECT_TOKEN_TYPES = {}));
-//# sourceMappingURL=FederatedConnectionAuthorizerParams.js.map
+//# sourceMappingURL=TokenVaultAuthorizerParams.js.map

package/dist/esm/authorizers/token-vault/TokenVaultAuthorizerParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenVaultAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/token-vault/TokenVaultAuthorizerParams.ts"],"names":[],"mappings":"AAKA,MAAM,CAAN,IAAY,mBAcX;AAdD,WAAY,mBAAmB;IAC7B;;;;OAIG;IACH,oGAA6E,CAAA;IAE7E;;;;OAIG;IACH,kGAA2E,CAAA;AAC7E,CAAC,EAdW,mBAAmB,KAAnB,mBAAmB,QAc9B","sourcesContent":["import { TokenResponse } from \"../../credentials\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext } from \"../context\";\n\nexport enum SUBJECT_TOKEN_TYPES {\n  /**\n   * Indicates that the token is an OAuth 2.0 refresh token issued by the given authorization server.\n   *\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.4 RFC 8693 Section 3-3.4}\n   */\n  SUBJECT_TYPE_REFRESH_TOKEN = \"urn:ietf:params:oauth:token-type:refresh_token\",\n\n  /**\n   * Indicates that the token is an OAuth 2.0 access token issued by the given authorization server.\n   *\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc8693#section-3-3.2 RFC 8693 Section 3-3.2}\n   */\n  SUBJECT_TYPE_ACCESS_TOKEN = \"urn:ietf:params:oauth:token-type:access_token\",\n}\n\nexport type TokenVaultAuthorizerParams<ToolExecuteArgs extends any[]> =\n  {\n    /**\n     * The Auth0 refresh token to exchange for an Token Vault access token.\n     */\n    refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The Token Vault access token if available in the tool context.\n     * This can also be provided as a string exchange when exchanging an access token for a Token Vault access token.\n     */\n    accessToken?:\n      | AuthorizerToolParameter<\n          ToolExecuteArgs,\n          TokenResponse | string | undefined\n        >\n      | string\n      | undefined;\n\n    /**\n     * This is used to specify the type of token being requested from Auth0 during the OAuth 2.0 token exchange request.\n     */\n    subjectTokenType?: SUBJECT_TOKEN_TYPES | undefined;\n\n    /**\n     * Optional login hint to provide when exchanging an access or refresh token for a Token Vault access token.\n     */\n    loginHint?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The scopes required in the access token of the token vault provider.\n     */\n    scopes: string[];\n\n    /**\n     * The connection name of the token vault provider.\n     */\n    connection: string;\n\n    /**\n     * AuthContext defines the scope of credential sharing:\n     * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n     * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n     * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n     * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n     *\n     * @default \"thread\"\n     */\n    credentialsContext?: AuthContext;\n\n    /**\n     * An store used to store the authorization credentials according\n     * to the `credentialsContext` scope.\n     */\n    store: Store;\n  };\n"]}

package/dist/esm/authorizers/{federated-connections → token-vault}/asyncLocalStorage.d.ts

@@ -3,7 +3,7 @@ import { TokenSet } from "../../credentials";
 import { ToolCallContext } from "../context";
 export type AsyncStorageValue = {
     /**
-     * The Federated Connection access token.
+     * The Token Vault access token.
      */
     credentials?: TokenSet;
     /**
@@ -11,11 +11,11 @@ export type AsyncStorageValue = {
      */
     context: ToolCallContext;
     /**
-     * The federated connection name.
+     * The token vault name.
      */
     connection: string;
     /**
-     * The scopes required to access the federated connection.
+     * The scopes required to access the token vault.
      */
     scopes: string[];
     /**
@@ -27,16 +27,16 @@ export declare const asyncLocalStorage: AsyncLocalStorage<AsyncStorageValue>;
 /**
  * Returns the entire tokenset for the current connection.
  *
- * Use `getAccessTokenForConnection` if you only need the access token.
+ * Use `getAccessTokenFromTokenVault` if you only need the access token.
  *
  * @returns {TokenSet} The current token set.
  */
-export declare const getCredentialsForConnection: () => TokenSet | undefined;
+export declare const getCredentialsFromTokenVault: () => TokenSet | undefined;
 /**
  *
  * Get the access token for the current connection.
  *
  * @returns The access token for the current connection.
  */
-export declare const getAccessTokenForConnection: () => string;
+export declare const getAccessTokenFromTokenVault: () => string;
 //# sourceMappingURL=asyncLocalStorage.d.ts.map